Cybersecurity · Saturday, 15 August 2026

01 · Briefing · what happened

The camera network that tracks cars just cut what it keeps

Cybersecurity 8 min 20 sources

Flock shortened how long it holds a record of where your car has been, after officers used the system to follow exes. A federal judge threw out mass phone-location orders the same week. And leaked files show federal staff looking up crushes. One theme runs through all three.

120,000

plate-reading cameras

across every US state but Alaska

30 to 7

days of records kept

Flock's new default retention

50+

officers charged with misuse

per a Washington Post investigation

1.6m

RingCentral accounts exposed

names, addresses, phone numbers

At a glance

Flock Safety cut the default time it keeps a record of where a car was seen from 30 days to seven.
Officers must now type a case number to search, and every customer must switch on automatic flagging of unusual searches.
The changes follow at least 50 officers charged with misusing the cameras, including cases of following exes.
Flock has 120,000 cameras and works with 7,000 police agencies, about 40% of US departments.
The same week, a federal judge ruled orders sweeping up every phone near a mast are unconstitutional.
Leaked files show US border staff accused of using government databases to look up romantic interests.
None of these records hold a message or a face. A plate, a place and a time were enough.
The ACLU calls Flock's changes a public relations move, noting a similar rule was worked around before.

Forces in play

Public backlash High↑

At least 50 US cities dropped Flock this year, including Los Angeles, after officers were caught using the cameras to follow exes.

Courts pushing back Building↑

A federal judge in Mississippi ruled that orders demanding every phone near a mast break the Fourth Amendment, whatever the case.

Company climbdown Easing↓

Flock's chief executive admitted it acted too late, cut records from 30 days to seven and made search auditing compulsory.

Collection still spreading High↑

Flock pitched pulling plate data from 350,000 rideshare dashcams, and a firm is marketing kit that ties your phone's radio signal to your car.

Ransomware on public services High→

A California city lost 911 call routing, and a hospital group in the Carolinas still has 10 sites shut more than two weeks on.

In play Flock Safety — cut retention to seven days and made search auditing compulsory Garrett Langley — Flock's chief executive, who admitted the company acted too late Judge Carlton Reeves — ruled mass phone-location orders unconstitutional as a category The ACLU — calls the changes public relations, not protection Customs and Border Protection — staff accused of misusing databases for personal reasons

How it unfolded

5 Aug A federal judge rules mass phone-mast records orders unconstitutional
10 Aug The New York Times maps the scale: 120,000 cameras, 7,000 agencies
12 Aug Three Georgia deputies arrested over alleged camera misuse
13 Aug Flock cuts retention to seven days and requires a case number
Next Whether the case-number rule survives contact with the officers using it

Where this points

Watch whether the compulsory auditing actually catches anything - the ACLU says a near-identical rule was worked around last year, and Flock has not explained what stops an officer typing a false reason.

Full briefing

Flock blinks

Flock Safety, the company whose cameras read number plates on American roads, announced a set of privacy changes on Thursday [1]. It is cutting the default time it keeps a record of where a car was seen from 30 days to seven [2]. It will require officers to type a case number before they search, a step that had been optional since July 2025 [1]. Every customer must switch on an auditing feature that flags unusual searching by the end of the year, and an account is suspended automatically while a review runs [1].

The company also lets a police department restrict what other agencies can see from its cameras. A city can now share scans for a stolen-car or missing-person case but not for immigration enforcement [3].

This is a climbdown, and the chief executive said so. Asked by the BBC whether it had taken too long to protect the cameras from misuse, Garrett Langley answered: “Yeah… yes” [2]. He said he now agrees with the American Civil Liberties Union and the Electronic Frontier Foundation that police should need an active case number to search. “They’re right. I think it should be required” [2].

What was actually happening

Flock has about 120,000 cameras and contracts with 7,000 law enforcement agencies, roughly 40% of American police departments [4]. The cameras photograph the plate, colour, make and model of every car that passes. They do not photograph faces or read messages. They collect what the trade calls metadata — not what you said or who you are, but the outer facts around you: a plate, a place, a time.

That turned out to be enough. A Washington Post investigation found at least 50 law enforcement officers have been charged with misusing Flock’s tools [1]. This week a police officer in New Bedford, Massachusetts was accused in court of using the cameras to follow an ex-girlfriend [1]. Three sheriff’s deputies in Georgia were arrested over similar allegations [1]. In one earlier case a Texas officer searched the national network for a woman who had had an abortion [2]. A man in Indiana learned through a records request that police had set an alert on his car, though he was not suspected of anything [2].

The backlash has cost money. At least 50 cities have cut ties with Flock this year, including Los Angeles [1]. Langley told the BBC that 16 of those have since come back, and that the company signs seven new customers for every one it loses [2].

Not everyone is convinced by the fix. Chad Marlow of the ACLU called the announcement largely a public relations move, noting that a similar search-justification requirement was rolled out before and staff found a way around it [1] [3]. It is unclear how the system stops an officer from simply typing a false reason [1].

The same week, three more versions of the same problem

A federal judge in Mississippi ruled on 5 August that “tower dumps” are unconstitutional as a category [5]. A tower dump is an order making a phone company hand over records of every device that connected to a given mast in a set window. The FBI, investigating gang violence in Jackson, had asked twice; a magistrate refused twice. Judge Carlton Reeves upheld the refusal and went further, finding that the requests would sweep in thousands of people near highways, hospitals, homes and places of worship [5]. No call content was involved. Just which phones were near which mast, and when.

Separately, WIRED obtained internal records under freedom-of-information law [6]. They show Customs and Border Protection staff and contractors accused of misusing government databases for personal reasons, over more than a decade [6]. Of nearly 300 data-related entries dating from 2009 to 2022, 138 were referred to management and 78 were serious enough to go to criminal investigators [6]. One officer allegedly pulled details from trusted-traveller applications to ask people out. Another employee allegedly used bought-in phone location data to track colleagues [6].

And Ars Technica reported on a system called SignalTrace that pairs a plate-reading camera with a sensor picking up the radio signals your phone and smartwatch broadcast [7]. Over repeated passes, software can associate a recurring device signal with a particular car. The signal carries no name. Its past pairing with a known car is what does the identifying [7]. Ars reported the technology is being marketed and tested rather than established police practice, with devices installed in Oxon Hill, Maryland [7].

Flock’s own ambitions ran the same way. Records obtained by 404 Media show it pitched a plan to pull plate data from 350,000 dashcams in Uber, Lyft and delivery drivers’ cars [5]. The pitch described a deal with the dashcam maker Nexar. Flock says the partnership never went ahead [5].

Breaches: a tax office, a phone company, an extortion crew

France’s tax authority confirmed late Thursday that an intruder got into its systems in late June and pulled data on individuals and businesses [8]. Access came through stolen or misused identity credentials and was cut off in June, the Economy Ministry said [8]. The breach only became public when a hacker using the name ZeroBytes advertised the data this week [9]. They claimed more than 2 million taxpayer records and said they used stolen logins plus a way around the second login check [9]. The claim is unverified. France’s tax authority disputes the hacker’s claim of ongoing access, and says it will notify affected people individually [8].

RingCentral, a business phone and messaging provider, was hit in July through what it called a social engineering campaign — attackers talking their way in rather than breaking a lock [10]. The extortion group ShinyHunters later published a 280GB archive. Have I Been Pwned added about 1.6 million unique email addresses, with names, addresses and phone numbers [10]. RingCentral says its core platform was not affected [10].

The extortion group ExfilSquad published data from 13 victims on 7 August, totalling roughly 383GB and 27 million records, researchers at Fortra confirmed [11]. Named victims include the City of Atlanta and the UK Department for Education [11]. The group released a censored version of a District of Columbia Public Schools leak, exposing 60,000 student records including names and dates of birth [11].

Ransomware kept the doors shut

The FBI, CISA and South Korea’s National Police Agency issued a joint advisory on Monday about Gunra, a ransomware crew built from leaked Conti code [12]. It is getting in through two Fortinet firewall flaws that CISA had already flagged, then stealing and encrypting data before demanding money [12]. Demands often exceed $10 million with five to seven days to pay, and targets span healthcare, finance and government [12].

AnMed, a nonprofit hospital group in Georgia and South Carolina, is still closed in places more than two weeks after an attack, with 10 facilities shut to appointments [13]. On Tuesday its Facebook page began posting ransom demands from a group calling itself The Gentlemen [13]. They claimed to have taken six terabytes of data, including sexual assault and mental health records [13]. They offered no evidence, and AnMed says it has not confirmed the scope [13].

Local government took a beating too. Suisun City, California lost 911 call routing, police and fire dispatch after malware hit on a Friday, and declared a state of emergency [14]. Coweta, Oklahoma lost all its computers to ransomware but had offsite backups [14]. And a cyberattack on the freight company Ceva Logistics disrupted eight European warehouses from 29 July [15]. It delayed orders for the Dutch retailer Bol, the department store De Bijenkorf and Steam’s hardware business [15]. Some customer shipping details may have been copied [15].

Patches worth your weekend

Microsoft fixed 398 flaws in its own products on Tuesday, 42 of them rated critical [16]. Counting third-party components the total was 421 [17]. One was already under attack: CVE-2026-68820, a flaw in the Windows component handling network connections, which lets an attacker who is already on a machine take full control [16]. Check Point told The Register that North Korea’s Lazarus Group was using it from early June [17].

Microsoft has attributed the recent flood of patches to artificial intelligence finding more flaws, and says hundreds a month is the new normal [16]. That is not a scare story. It means the gap between “a flaw is public” and “you have installed the fix” is now the thing that matters. That gap belongs on a calendar, not a to-do list.

One flaw has no fix yet. A researcher publicly posted a database-injection flaw in GeoServer, open-source mapping software, at 10:46 UTC on 12 August [18]. Researchers at watchTowr saw hundreds of probing attempts within hours, from a small pool of addresses, mostly checking which servers are vulnerable rather than breaking in [18]. If your organisation runs GeoServer, it should not be reachable from the open internet right now.

Washington hands part of the offence to private firms

A presidential memorandum signed on Wednesday will let vetted American companies run offensive cyber operations against foreign cybercrime groups, working under the Justice and Homeland Security departments [19]. Every operation needs written approval in advance. Nothing may cause loss of life or amount to use of force under international law, and participating firms must post a bond of at least $1 million [19].

The practical question is oversight of a capability that has until now sat with governments. Germany moved in a parallel direction the same week. Its cabinet approved a 732-page bill letting intelligence agencies hack foreign systems and sabotage adversaries’ supply chains [20]. It still needs to clear parliament [20].

02 · Lesson · why it matters

The half of privacy nobody thought to encrypt

Keeping your words secret is only half of privacy. Who you contacted, when, and from where tells the story on its own.

How it works

Encryption hides what you said
It cannot hide who, when, where, how often
That outer envelope is easy to collect at scale
Patterns in it reveal relationships and routines
So the pattern identifies you without any content

The twist

You can keep the contents perfectly secret and still give away the whole story, because the shape of your traffic is a fingerprint nobody thought to encrypt.

Where you've seen this

Phone bills

no words, but a call log shows the affair, the lawyer, the diagnosis

Your front door

a delivery van's timing tells a watcher when the house is empty

Office networks

defenders spot intruders by odd traffic patterns, never by reading files

Sealed envelopes

the postmark, the sender and the weight say plenty before you open it

The catch

The same pattern-reading that lets a stalker find you is what lets a defender spot a break-in, so the fix is never to stop looking - it is to keep less, and to log who looks.

Full lesson

A camera that never sees your face

The cameras at the centre of this week’s fight do not photograph faces. They do not read your messages or hear your calls. They photograph a number plate, note the colour and make of the car, and record the time and the pole they are attached to. That is all.

It was enough for officers to follow ex-partners. It was enough, in one case, to search a national network for a woman who had had an abortion. Nothing about those searches required breaking any encryption. The record was never secret in the first place.

What the outer envelope carries

Security people call this metadata: not the contents of a thing, but the facts around it. Who, when, where, how long, how often, how big.

The word sounds harmless, and that is most of the problem. Any single line is meaningless. Your car at a junction at 8.15 on a Tuesday tells nobody anything.

Repetition is what does the work. The same plate at the same junction at the same hour, five days a week, is your commute. The same plate parked outside the same building every night from eleven is your home address, and nobody had to write it down. A car that appears twice near a place you have no reason to be is a question a stranger can now ask about your life.

That is the trick metadata plays. Each observation is trivial. The pattern of them is a portrait.

Why it is the easy half to collect

There is a reason the outer envelope is where the collecting happens, and it is not carelessness.

Contents are expensive. They are large, they are increasingly encrypted by default, and the law has treated them as private for a very long time. You generally need a warrant naming a person.

The envelope is the opposite. It is small, cheap to store, and often unavoidable, because the system cannot work without it. A phone network has to know which mast your handset is talking to, or it cannot ring you. A road camera has to see the plate, or it cannot spot a stolen car.

And the envelope has spent decades being treated as barely private at all, on the reasoning that you handed it to a company voluntarily. That reasoning was a choice made by courts and legislatures, and it now sits underneath everything as though it were plain fact. This week a federal judge began pulling at it, ruling that an order sweeping up every phone near a mast breaks the Fourth Amendment however narrow the window. The line was always drawn somewhere. It just stopped being obvious where.

The same signal that catches the intruder

Here is the part that makes this hard rather than simply bad.

Metadata is also how defence works. Nobody spots a break-in by reading the files. They spot it because a machine that talks to two servers is suddenly talking to forty. Or because an account that logged in from one city at nine logged in from another at three. The break-in is invisible; its shape is not.

So the honest answer is never to stop looking. It is to keep less, for less time, and to make looking leave a mark of its own. Cut the record from thirty days to seven and most stalking becomes impossible while most investigations still work. Require a reason typed in before a search, and log every search, and the pattern-reading turns back on the watcher.

Whether that holds depends entirely on whether anyone checks the log. A rule nobody audits is a rule in name.

Who is already in this

You are in it, and you did not agree to be. Your car passes cameras you will never see. Your phone announces itself to anything listening, several times a minute, whether or not you use it.

The exposure is not evenly shared. A pattern is most dangerous to whoever has most to lose from being findable. Someone leaving a violent house. Someone seeking care their state has made illegal. Someone who went to a demonstration once. For most people, most weeks, the record sits unread. That is not the same as being safe. It is being lucky about who happens to be looking.

And nobody at any one seat sees the whole shape of it. The officer sees one search. The company sees a contract and a camera count. The judge sees a single application, and rules on that. The person driving home sees a small black box on a pole, if they notice it at all. The picture only exists when all those partial views are laid on top of each other. Which is to say it exists mostly nowhere, and to no one, until somebody decides to look.

03 · Lab · your turn

Read the Envelope

Switch on privacy protections one at a time and see which questions an outside watcher can still answer about your users.

04 · Hope · carry this

Nobody had to break anything to collect those records. What changed this week is that enough ordinary people noticed, and a company, a court and a newsroom each moved because of it.